CN104639388A - DNS server availability detection method based on user perception - Google Patents

Abstract

The invention discloses a DNS server availability detection method based on user perception. The method comprises the steps: (1) respectively setting a monitoring point on a set node server; (2) selecting M measurement data indexes; periodically transmitting an order to the monitoring point by a dispatching server to acquire the data; (3) calculating a benchmark service quality parameter Um of each index according to a benchmark DNS authoritative server sample set to obtain a set X minute; (4) calculating a service quality parameter Um minute of each index according to the acquired measurement data to obtain a set Y minute; (5) determining a contribution degree of each index relative to the benchmark service quality parameter according to the statistics correlation of the set Y minute and the set X minute; (6) calculating the service quality of each DNS recursive server according to the contribution degree of each index relative to the benchmark service quality parameter, and obtaining the availability of the target DNS authoritative server. According to the method, data support is provided from an external viewpoint so as to be used for the decision and judgment.

Description

A kind of dns server method for detecting availability based on user awareness

Technical field

The present invention relates to a kind of dns server method for detecting availability based on user awareness, belong to networking technology area.

Background technology

The develop rapidly of the Internet, bring life and office efficient and convenient.But the taking place frequently of network security accident in recent years, also manifest the fragility of internet.Domain name system (DNS) is as one of the important infrastructure of the Internet, play a part indispensable in the normal operation ensureing the Internet, the fail safe of DNS also affects the safety and efficiency of whole the Internet, therefore just seems particularly important to the analysis of DNS security and research.DNS Protocol is just short of consideration when initial design to safety factor, and the fragility existing for agreement itself makes dns server often be faced with full spectrum of threats.

The problem discover of DNS authority server availability fault is mainly by inner monitoring and flow analysis, but this mode can only be pinpointed the problems from the angle of O&M, cannot accurately weigh from user perspective the influence degree and coverage that whether have fault and fault.Because, 1) DNS authority server much adopts mirror-image fashion to provide service (such as root, com and cn etc.), even if a mirror image breaks down, the scheme of bgp+anycast can automatically switch to other mirror images, alleviates or eliminates the impact on user; 2) what user directly accessed is DNS recursion server, and recurrence with the time buffer memory authority resolution data of TTL, also can alleviate the fault of user awareness to authoritative server to a certain extent.

Summary of the invention

Relative to the DNS authority server failure problem from interior angle monitoring, discovery target domain name, the present invention has designed and Implemented a kind of distributed DNS data acquisition and method for detecting availability, provides data supporting, judge for decision-making from external view; The object of the invention is to: 1) easy task scheduling strategy, with adaptive network environmental change; 2) reliable DNS acquisition strategies is adopted, to reduce the fluctuating error that UDP packet loss brings; 3) whether there is DNS availability fault, influence degree and coverage based on the real-time analysis of active probe data; 4) by analysis result export, as the foundation of system operation maintenance personnel handling failure, and for decision-making judgement provide support.

Technical scheme of the present invention is:

Based on a dns server method for detecting availability for user awareness, the steps include:

1) on the node server of setting, monitoring point is set respectively;

2) M measurement data index is chosen; Dispatch server regularly sends order to appointment monitoring point, carries out data acquisition after monitoring point receives orders to target DNS authority server;

3) calculate the benchmark QoS parameter Um of each index according to Base DN S authoritative server sample set D, obtain a set X ';

4) according to step 2) measurement data that gathers calculates the QoS parameter U of each index _m', obtain a set Y ';

5) according to set Y ' and the contribution degree gathering the statistic correlation of X ' and determine each index relative datum QoS parameter;

6) to step 2) data that gather divide, according to step 5 according to DNS recursion server) contribution degree of each index relative datum QoS parameter that calculates, calculate the service quality of each DNS recursion server;

7) according to step 6) the described service quality that calculates obtains the availability of target DNS authority server.

Further, formula is utilized calculate the benchmark QoS parameter Um of m class index; Wherein, set D comprises M subset, and m subset dm preserves the sample data of m class index; Q (i, m) represents i-th sampled data values of dns server m class index, and C (D) is the total sample number in set D.

Further, formula is utilized $Z=\frac{\mathrm{\ΣQ}(i,m)\mathrm{\Σ}{Y}^{\′}-\frac{\mathrm{\ΣQ}(i,m)\mathrm{\Σ}{Y}^{\′}}{N^{\′}}}{\sqrt{(\mathrm{\Σ}{X}^{\′2}-\frac{{\left(X^{\′}\right)}^2}{N^{\′}})}(\mathrm{\Σ}{Y}^{\′2}-\frac{{\left(\mathrm{\Σ}{Y}^{\′}\right)}^2}{N^{\′}})}$ Calculate the contribution degree Z of each index relative datum QoS parameter; Wherein, Z={a _m.

Further, M selected measurement data index is: the path round-trip time delay of target DNS authority server, packet loss and domain name mapping correctness.

Further, described step 6) in, first each index measurement data is normalized, then calculates the service quality of each DNS recursion server; Wherein, the service quality of the n-th DNS recursion server t _nbe the path round-trip time delay of the n-th DNS recursion server, G (T _n) be the path round-trip time delay after normalized; E _nbe the packet loss of the n-th DNS recursion server, G (E _n) be the packet loss after normalized; F _nbe the domain name mapping correctness of the n-th DNS recursion server, G (F _n) be the domain name mapping correctness after normalized; β is the contribution degree of path round-trip time delay, and ρ is the contribution degree of packet loss, and ω is the contribution degree of domain name mapping correctness.

Further, if TTL is less than 5 minutes, then the transmission cycle of described order is that p=(ttl/60) rounds up; If TTL is more than or equal to 5 minutes, then the transmission period p of described order is 5 minutes; One or more order is sent within the same transmission cycle; Order described in each and repeat to send repeatedly within the same transmission cycle, each order all returns at least one acquisition and recording, then this target DNS authority server is normal, otherwise judges that this target DNS authority server is as time-out.

Further, the measurement data of different indexs that monitoring point returns by described dispatch server is deposited in the measurement data subset of corresponding index.

Further, described step 7) in, utilize formula calculate the service quality QoE of target DNS authority server, wherein, K _mbe the weights of m index, N is DNS recursion server sum.

Further, each index historical measurement data collection of a dns server set up by described scheduler; And cluster sampling is carried out to this historical measurement data collection set up a proper network baseline; Then each for current dns server index measurement data compared with proper network baseline, be greater than set point if departed from, carry out fault warning.

Further, adopt the statistical model based on variance to detect target DNS authority server service quality, its method is: based on the QoS parameter U of variance statistic to each index _m' calculate a confidential interval; Within the setting-up time cycle, if when the QoS parameter of last index is in the confidential interval of correspondence, then think normal, otherwise think and break down.

Compared with prior art, advantage of the present invention:

1) provide data supporting from external view, judge availability for decision-making, simplify the task configuration of DNS data acquisition, user only needs to provide target domain name, and system realizes configuring based on the DNS task of the complexity of problem discover automatically simultaneously;

2) reliability of the DNS data gathered is improved by 3 kinds of modes (three retries, repeatedly detect, according to the configuration of result of detection filtration duty);

3) method based on variance statistic is adopted to realize the fault warning of DNS availability.

Accompanying drawing explanation

Fig. 1 is scene 1 data acquisition flow figure;

Fig. 2 is scene 2 data acquisition flow figure;

Fig. 3 is the inventive method building-block of logic.

Embodiment

Below in conjunction with accompanying drawing, the present invention is explained in further detail.

The key technical problem that the present invention solves is the availability fault finding " the DNS authority server of target domain name ".Dns resolution relates generally to two paths: user is to recursion server, and recursion server is to authoritative server; Therefore two kinds of scenes are considered, 1) simulation " DNS recursion server ", access DNS authority server, as Fig. 1; 2) simulate " user ", by the DNS recursion server of ISP (Internet Service Provider), access DNS authority server, as Fig. 2.

First the present invention arranges monitoring point on the server of each important network node or ISP, and such as just domestic, selected server needs to cover each province's major carrier as far as possible.This is because: 1) the DNS authority service of crucial domain name can provide High Availabitity service (such as root/com/cn etc.) by many mirror nodes, the broadcast strategy of each mirror nodes has dividing of global and local, for the node of local, can only have access in broadcasting area; 2) user has Regional Property, only covers the main line of user's access, could react the situation of DNS authority service truly; 3) the DNS recursion service of each ISP also has local attribute, in general only provides service to the user of this area, this operator.

The solution of the present invention is mainly from the viewpoint of following several: task scheduling, data snooping, data analysis, alarm export.Module's logic structure figure as shown in Figure 3.

(1) task scheduling

Be devoted to the availability fault finding DNS, need to initiate detection to target DNS authority server, image data incessantly; Be used for doing the mainly response time data of fault detect, dispatch server timing sends order to monitoring point, and perform acquisition tasks after monitoring point receives orders, issuing which monitoring point can configure, and acquiescence issues all monitoring points.According to the ageing requirement of pinpointing the problems, there is different settings to the frequency of data acquisition.Frequency is too high, can inject comparatively large discharge to network, makes the load of objective network higher; Underfrequency, the time delay of pinpointing the problems is higher, is unfavorable for that fault is disposed, and even delaying decision judges.Consider the caching mechanism of DNS, in our scheme of the invention, being set to of detect cycle:

P={ (ttl/60) rounds up (min) ifttl<300; 5min ifttl>=300}

Why so get: 1) within 5 minutes, be one can according to the business demand self-defining fault discovery time; TTL is less than 5 minutes, needs to pinpoint the problems about the TTL time; TTL is more than or equal to 5 minutes, and the fault discovery time can not more than 5 minutes; 2) granularity in cycle is accurate to minute, so that technology realizes.

Scene 2) analog subscriber time, need by DNS recursion server access destination DNS authority server, because DNS recursion server has ISP attribute, each monitoring point should be selected the DNS recursion server of corresponding province and operator, and do continuity testing.

Scene 1, the order that dispatch server sends comprises following information:

Monitoring objective domain name, monitoring item (response time, correctness etc.), monitoring point, detection times;

Scene 2, the order that dispatch server sends comprises following information:;

Monitoring objective domain name, monitoring item (response time, correctness etc.), monitoring point, recursion server IP, detection times.

(2) data acquisition

1) DNS mainly provides service by udp protocol, and due to the unreliability of udp protocol, packet loss can often exist; In order to avoid UDP packet loss gives the follow-up impact brought of pinpointing the problems, in the following way, detect three times, within three times, have response, then think normal, return a result of detection, otherwise be time-out.

2) if need many acquisition and recordings in a detect cycle, to improve the accuracy of data further, the mode of multi collect can be adopted.

(3) data analysis and alarm

3.1 performance index definition and evaluation method

DNS is served, to experience from the intuitive service of user perspective be exactly response time of DNS authority server parses and its success rate (determining based on the response time), whether accuracy (is mainly used to detect domain name kidnap, by NS and the A record of dig domain name, then combine the contrast of existing list whether unanimously to obtain) whether in tolerance etc., so these performance index are users can the DNS service quality that arrives of direct feeling.For this reason, primarily to formulate reference performance index and estimate the DNS service quality standard carrying out characterizing consumer perception, as sign QoS parameter.

If Base DN S authoritative server sample set is D, set D comprises M subclass d, wherein m subclass dm preserves the sample data of m class measurement index, Q (i, m) i-th measurement data desired value of the measurement performance index of dns server m class is represented, C (D) is the total sample number in set D, then the benchmark QoS parameter Um of m class performance index is formula (1-1):

$\mathrm{Um}=\frac{\underset{i\&Element;\mathrm{dm}}{\mathrm{\&Sigma;}}Q(i,m)}{C\left(D\right)}---(1-1)$

Carried out the weighted calculation of network performance index by the contribution degree of indices to the benchmark QoS parameter of user awareness calculating end to end network performance, thus draw the service quality evaluation quantitative model of unified dns server.

For the target DNS authority server performance index arrived by Active measuring, by unified formula (1-2), statistical analysis is carried out to it:

$\mathrm{RC}={(\&CirclePlus;Y_m)}_{m\&Element;V}={(\&CirclePlus;\left({\&CirclePlus;y}_{m,j}\right))}_{m\&Element;V,j\&Element;R_m}---(1-2)$

the data set by measuring the DNS performance metric result obtained, wherein

represent the measurement result collection of m class DNS performance metric, y _m,jit is the measurement result of the jth kind state of m class DNS performance metric index.

R _m=(y _m1, y _m2... y _mj..., y _mJ) represent the measurement result state set of m class DNS performance metric, state sum in J.

V={1 ..., m ..., M} represents performance set of metrics.Total M kind performance participates in tolerance.Comprehensive performance evaluation is exactly a kind of m unit carried out on X operation and the n unit carried out on Y what operate is comprehensive, for xor operation.

Suppose T _irepresent and measure the path round-trip time delay obtained, E i-th time _irepresent and measure the packet loss obtained, F i-th time _irepresent and measure the domain name mapping correctness obtained i-th time, if set Z={a _mrepresenting the contribution degree of each network performance index to DNS benchmark QoS parameter, the statistic correlation of being closed by the set of computing network performance index and DNS benchmark QoS parameter set determines the value of corresponding contribution degree.Contribution degree formula is shown in formula (1-3):

$Z=\frac{\mathrm{\&Sigma;Q}(i,m)\mathrm{\&Sigma;}{Y}^{\&prime;}-\frac{\mathrm{\&Sigma;Q}(i,m)\mathrm{\&Sigma;}{Y}^{\&prime;}}{N^{\&prime;}}}{\sqrt{(\mathrm{\&Sigma;}{X}^{\&prime;2}-\frac{{\left(X^{\&prime;}\right)}^2}{N^{\&prime;}})}(\mathrm{\&Sigma;}{Y}^{\&prime;2}-\frac{{\left(\mathrm{\&Sigma;}{Y}^{\&prime;}\right)}^2}{N^{\&prime;}})}---(1-3)$

In formula

The DNS benchmark QoS parameter set of X '---measurement closes list, namely according to M the Um set that sample data utilizes formula (1-1) to calculate;

The corresponding network performance index parameter sets list of Y '---measurement, namely according to M the Um set that Active measuring data separate formula (1-1) calculates.

N ' is measurement data sum.

$G\left(x\right)=\frac{x-\mathrm{Min}\left(x\right)}{\mathrm{Max}\left(x\right)-\mathrm{Min}\left(x\right)}---(1-4)$

X in formula---a certain class index measurement data once;

Min (x)---the minimum value of all x measurement data;

Max (x)---the greatest measure of all x measurement data.

See formula (1-4) based on formula (1-3) and data normalization unified process function, by network performance index and the service quality evaluation result contribution degree of DNS service quality being calculated to DNS thereof, formula (1-5) can be seen:

$\mathrm{Qo}{S}_n=\frac{\mathrm{\&omega;G}\left(F_n\right)}{\mathrm{\&beta;G}\left(T_n\right)+\mathrm{\&rho;G}\left(E_n\right)}---(1-5)$

In formula

T _n---the path round-trip time delay of measurement;

E _n---the packet loss of measurement;

F _n---the domain name mapping correctness of measurement;

β---the contribution degree of path round-trip time delay;

The contribution degree of ρ---packet loss;

ω---the contribution degree of domain name mapping correctness;

QoS _nrepresent the service quality evaluation result of the n-th DNS recursion server, function representation is for the unified normalization computational methods of network performance index.

By the transmission contribution relation of the stratification of network element, extract corresponding critical network performance index parameter, calculate its contribution degree for DNS benchmark QoS parameter by statistic correlation, finally can be calculated and evaluate the overall quality of service of a DNS authority server by this model.

User's subjective feeling to QoS be QoE (Quality ofExperience), both main distinctions are that QoS is objective, and QoE is subjective.In order to further illustrate the relation between QoS and QoE, introduce the concept of quality of service index herein.

Quality of service index (KQI, Key Quality Indicator) is the key index at service layer reflection user-perceptive quality, and be one group of qos parameter that can carry out measuring, service feature index focuses on the service layer that user pays close attention to.The customer-centric of quality of service index, reflects user awareness in a certain respect, and the combination of several quality of service indexs is user awareness, by determining user awareness level to the measurement of quality of service index.

The quantitative relationship of user awareness QoE and quality of service index KQI, see formula (1-6):

$\mathrm{QoE}=\underset{m=1}{\overset{M}{\mathrm{\&Sigma;}}}{K}_m\underset{n=1}{\overset{N}{\mathrm{\&Sigma;}}}\mathrm{Qo}{S}_n---(1-6)$

In formula, QoE represents the user awareness of certain business, and Km is m the weight between KQI and user awareness, QoS _nbe the service quality evaluation result of the n-th DNS recursion server, wherein L=3 represents that user awareness is divided into three dimensions: the domain name mapping correctness of the path round-trip time delay of measurement, the packet loss of measurement and measurement.

5 points of tabulations are generally adopted to show for QoE, corresponding excellent, good, in, secondary, bad.Table 1 represents the corresponding relation between score value, quality of service, user satisfaction and the business extent of damage.

Relation between table 1QoE score value, quality of service, user satisfaction and the business extent of damage

QoE score value	Quality of service	User satisfaction	The business extent of damage
				5	Excellent	Very satisfaction	Cannot serve influenced by perception DNS
4	Good	Satisfied	Can serve influenced by perception DNS, but

			Can ignore
				3	In	Certain customers are unsatisfied with	Part NS or ISP service is influenced
2	Secondary	A lot of user is unsatisfied with	Major part NS or ISP service is influenced
				1	Bad	Most of user is unsatisfied with	Overall access is obstructed

3.2 data analyses and alarm

Carry out the alarm detection based on user awareness, first must set up normal network measure model, then contrast normal model and can identify exception.Adopt the method based on variance statistic to realize availability fault warning herein, using the Probability Statistics Theory of maturation as theoretical foundation, utilize the historical behavior of DATA REASONING to detect current abnormal failure.

After the user awareness that have accumulated some estimates statistics, the serial historical behavior just defining different scene can estimate collection.Utilize these index historical measurement data, the proper network baseline in time in the past cycle is set up in cluster sampling.Current measurement behavior is compared with normal network baseline, if when significantly departing from appears in current measurement behavior and proper network baseline, namely thinks the fault warning occurred in various degree, and can analyse in depth further; If two kinds of behaviors do not have obvious deviation, then think normal and upgrade proper network measurement model.

Changeable due to measurement data, all historical measurement data and current measurement data can not be used to compare, use the measurement data in nearest cycle and periodic samples data as estimating collection herein, and adopt sliding window to carry out measurement data renewal, ensure that problem detection is more accurate.

Adopt the statistical model based on variance to carry out fault detect herein, by the variance of calculating parameter, set its confidential interval, show there is fault or exception when the scope of measured value beyond confidential interval.

According to central-limit theorem, if the stochastic variable X studied can be expressed as independently stochastic variable X ₁, X ₂..., X _nsum, if X _i(i=1,2 ..., n) relatively independent to X, can think X Normal Distribution.Because the measurement based on user awareness is all independently variable, this theorem therefore can be used to carry out measurement evaluation.

Sample standard deviation is defined as:

$S_n=\sqrt{\frac{1}{n-1}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{X}_i^2-n{\stackrel{\&OverBar;}{X_n}}^2)}$

According to the distribution situation of Normal Mean, sample average standard deviation be

Population mean confidence level is the confidential interval of (1-α)

$(\stackrel{\&OverBar;}{X_n}-Z_{a/2}\frac{S_n}{\sqrt{n}},\stackrel{\&OverBar;}{X_n}+Z_{a/2}\frac{S_n}{\sqrt{n}})$

Wherein, α is called the level of signifiance, Z _a/2for the bilateral critical value of standardized normal distribution, Z _a/2can check in from gaussian distribution table, then in conjunction with the quadratic sum of sample number n, sample and sample average square the standard deviation of sample average and the confidential interval of population mean can be calculated.If estimate in this confidential interval in certain time cycle, then think normal, otherwise think and occur fault in various degree and carry out abnormality processing.

Only judge abnormal according to the statistics number calculating confidence space, not enough fully, these numerical value may because the reason (as System Expansion etc.) of some non-faulting causes instantaneous not normal, and we want to tolerate that these instantaneous statistical values are not normal.

It should be noted that the Statistic features of different stage DNS is different in addition, confidence spatial statistics result gap is also comparatively large, will treat respectively when alarming processing.Owing to being difficult to provide a quantitative computing formula, provide importance factor hierarchical table according to its importance here, as shown in table 2.

Table 2 importance factor hierarchical table

Next also difference alarm statistics to be carried out for different scenes, such as

1) scene 1: for NS, for operator, entirety;

2) scene 2: for operator, entirety;

To the different business under each scene, different quality of service indexs and parameter to be formulated respectively, do not specifically describe at this.

The cycle of alarm is herein general shorter, and be generally about 5 minutes, the exception for DNS generally continues the longer time, and the statistical value fallen into above outside confidential interval is instantaneous exception does not have continuation, in order to reduce rate of false alarm, introducing alarm queue herein, wouldn't abnormal behaviour be judged as.The number of just adding up abnormal numerical value is N, N can increase and decrease dynamically in alarm queue, each through a time slip-window, N reduces according to the fixed attenuation value γ in table 2 importance factor hierarchical table, if N<0 represents without exception and removes from alarm queue, and real abnormal generally can detect that statistical value extremely in (recently repeatedly with the same period than) repeatedly analyzing continuously, repeatedly the rear discovery of increase and decrease exceedes the abnormal threat value threshold that we pre-set, then be transformed in corresponding QoE, carry out corresponding alarming processing and point out which link goes wrong, such as just one of them NS delays machine, alarm is to operation maintenance personnel, reparation problem, if overall access is obstructed, high severity alarm, need notice all departments Coordination Treatment.

Claims (10)

1., based on a dns server method for detecting availability for user awareness, the steps include:

1) on the node server of setting, monitoring point is set respectively;

2) M measurement data index is chosen; Dispatch server regularly sends order to appointment monitoring point, carries out data acquisition after monitoring point receives orders to target DNS authority server;

3) calculate the benchmark QoS parameter Um of each index according to Base DN S authoritative server sample set D, obtain a set X ';

4) according to step 2) measurement data that gathers calculates the QoS parameter U of each index _m', obtain a set Y ';

5) according to set Y ' and the contribution degree gathering the statistic correlation of X ' and determine each index relative datum QoS parameter;

6) to step 2) data that gather divide, according to step 5 according to DNS recursion server) contribution degree of each index relative datum QoS parameter that calculates, calculate the service quality of each DNS recursion server;

7) according to step 6) the described service quality that calculates obtains the availability of target DNS authority server.

2. the method for claim 1, is characterized in that, utilizes formula calculate the benchmark QoS parameter Um of m class index; Wherein, set D comprises M subset, and m subset dm preserves the sample data of m class index; Q (i, m) represents i-th sampled data values of dns server m class index, and C (D) is the total sample number in set D.

3. method as claimed in claim 2, is characterized in that, utilize formula calculate the contribution degree Z of each index relative datum QoS parameter; Wherein, Z={a _m.

4. the method as described in claim 1 or 2 or 3, is characterized in that, M selected measurement data index is: the path round-trip time delay of target DNS authority server, packet loss and domain name mapping correctness.

5. method as claimed in claim 4, is characterized in that, described step 6) in, first each index measurement data is normalized, then calculates the service quality of each DNS recursion server; Wherein, the service quality of the n-th DNS recursion server t _nbe the path round-trip time delay of the n-th DNS recursion server, G (T _n) be the path round-trip time delay after normalized; E _nbe the packet loss of the n-th DNS recursion server, G (E _n) be the packet loss after normalized; F _nbe the domain name mapping correctness of the n-th DNS recursion server, G (F _n) be the domain name mapping correctness after normalized; β is the contribution degree of path round-trip time delay, and ρ is the contribution degree of packet loss, and ω is the contribution degree of domain name mapping correctness.

6. the method for claim 1, is characterized in that, if TTL is less than 5 minutes, then the transmission cycle of described order is that p=(ttl/60) rounds up; If TTL is more than or equal to 5 minutes, then the transmission period p of described order is 5 minutes; One or more order is sent within the same transmission cycle; Order described in each and repeat to send repeatedly within the same transmission cycle, each order all returns at least one acquisition and recording, then this target DNS authority server is normal, otherwise judges that this target DNS authority server is as time-out.

7. the method for claim 1, is characterized in that, the measurement data of the different indexs that monitoring point returns by described dispatch server is deposited in the measurement data subset of corresponding index.

8. the method for claim 1, is characterized in that, described step 7) in, utilize formula calculate the service quality QoE of target DNS authority server, wherein, K _mbe the weights of m index, N is DNS recursion server sum.

9. the method for claim 1, is characterized in that, each index historical measurement data collection of a dns server set up by described scheduler; And cluster sampling is carried out to this historical measurement data collection set up a proper network baseline; Then each for current dns server index measurement data compared with proper network baseline, be greater than set point if departed from, carry out fault warning.

10. the method as described in claim 1 or 9, is characterized in that, adopt the statistical model based on variance to detect target DNS authority server service quality, its method is: based on the QoS parameter U of variance statistic to each index _m' calculate a confidential interval; Within the setting-up time cycle, if when the QoS parameter of last index is in the confidential interval of correspondence, then think normal, otherwise think and break down.